Red Hat Product Security issued an advisory (RHSA-2025:13646) for Mozilla Thunderbird in Red Hat Enterprise Linux 8.4 addressing nine distinct vulnerabilities (CVE-2025-8027 through CVE-2025-8035). The flaws include a large branch table leading to truncated instructions, multiple memory safety bugs, incorrect URL stripping in CSP reports, partial return value writes in the JavaScript engine stack, potential user-assisted code execution via the 'Copy as cURL' command, incorrect JavaScript state machine behavior for generators, CSP bypasses through XSLT documents, and execution of javascript: URLs on object and embed tags. These issues affect Thunderbird as integrated with Firefox components. The advisory provides updated packages to fix these vulnerabilities. No CVSS scores are provided in the advisory, but the overall severity is rated as Important by Red Hat.

The vulnerabilities impact the security of Mozilla Thunderbird by enabling potential memory corruption, code execution (including user-assisted), bypass of security policies such as CSP, and incorrect handling of JavaScript execution contexts. Exploitation could lead to unauthorized code execution or security policy circumvention within the Thunderbird client, increasing the risk of compromise or data exposure. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Update Support that address these vulnerabilities. Users should apply the provided security update (RHSA-2025:13646) promptly to remediate the issues. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. There is no indication that additional mitigations beyond applying the update are required.